I think my device got a malware. A lock screen with ads sometimes appear, and I must swipe an area at the bottom of the screen to open the phone. I am in Eastern Europe, some ads are in Slavic languages, and they are seemingly related to travel.

Image resized. Click to view the full image

I have seen ads for Lot Air (Polish carrier). I recently went to their site.

Considering my recent surfing activity and the nature of the ads, I guess the malware is connected to airlines active in Eastern Europe.

The lock screen also promotes the app "DU Quick Charger" by claiming it has recharged the phone extra fast during screen off. (!?) It also shows battery level. I have never installed DU Quick Charger. I doubt DU Quick Charger is installed on the phone.

The problem started after installing Ryanair app. The problem is maybe, but not surely, related to this. Uninstalling Ryanair and restarting the phone doesn't remove the occasional appearance of this lock screen.
After a while the situation has changed for the worse, now this lock screen appears after EVERY screen off.

I have always used Avast. I am not rooted and only install via Google Play.

Thanks. I really appreciate your input. The problem right now is that I am travelling. I haven't seen a PC for months. As soon as I get to one I will try your suggestion. / Is there anything else to do before that?
– ycc_sweApr 25 '16 at 20:00

So does this lock screen appears out of nowhere, I mean you're using your device and then it shows up, or, you put the device to sleep, awake it and gets to see that lock screen? You've also made certain that there is no fishy device administrator under Settings -> Security -> Device administrators?
– Firelord♦Apr 25 '16 at 20:02

Device administrators ok. / It never appears "suddenly" when I work on the phone. It only appears after waking up the screen saver, f.ex after closing flip cover, pressing on/off button or "spontaneous black screen after 2 min inactivity". Right now every time! But not always every time. // I'll come up with a better error-description when I can.
– ycc_sweApr 25 '16 at 20:13

Thanks. It is late in my time zone. I'll come back as soon as I can with list of "draw over" apps.
– ycc_sweApr 25 '16 at 20:40

Disabling DU Quick Charge may not work on devices. In this case insure that you completely remove the application. If the quick charge screen continues to display, check to see if you have any other apps that have this "adware" and remove them.

EDIT:

Based on the information seen in another question I wanted to update this answer. It seems like quite a handful of applications have added this lockscreen replacement in their latest updates. There is one Reddit discussion which mentions a few apps.

THANKS, THAT SEEMS TO HAVE REMOVED THE UNWANTED ADWARE! Opening ES App Locker not possible since it was locked with a pattern. I NEVER USE PATTERN. It thus seems like a very risky program. (But ES File Explorer Pro is the file manager I mostly use, unfortunately.) It was possible to uninstall ES App Locker though. But then stock pin-lock screen appeared in Android. Fortunately correct pin was an old one I once tried. THANKS AGAIN. I'LL COME BACK IF PROBLEM REAPPEARS. VERY VALUABLE ANSWER.
– ycc_sweApr 26 '16 at 7:02

5

I switched away from ES File Explorer after using it for like 3 years just because of the integration of ads and changing the user-interface. The once simple-to-handle program has changed a lot in my opinion. If you're looking for a replacement in the near future you can check out @Izzy s list of applications for filemanaging
– benjaminApr 26 '16 at 8:19

@AndrewT. Added :) I'll check the reddit thread from time to time in the next few days and have a look at future questions which may address this issue and add these apps when I can. If you or anyone else finds more feel free to edit them in or (if it makes sense) make this a community-wiki :)
– benjaminApr 26 '16 at 14:08

It seems ES File Explorer does this now - I have had it installed for years, but today I saw DU Quick Charge pop up and it seems to be tied with an update of ES File Explorer. I uninstalled it and the malware is gone.

Thanks. If this lock screen reappears I will uninstall the free version. It is often also time consuming to uninstall, since you have to enter all passwords (cloud, ftp), set up windows etc when you reinstall.
– ycc_sweMay 10 '16 at 18:11

The XDA post explains, set up of Fiddler, creating a proxy, connecting your phone and laptop on the same WiFi network and analysing traffic. In particular, it analysed traffic from ES Explorer and says

Even though the Pro version does not come with ads, several MBs worth are still being downloaded just not shown.

The app is built poorly with no regard for efficiency.

The app is communicating with Baidu constantly.

Post ends with pictorial evidence of other malware assosciated with ES Explorer

It was ES App Locker, and they are currently sock puppet blasting the app with 5 star ratings to try and counter the deluge of 1 stars... It's pretty sad actually, and it's why I switched to Solid File manager, which I actually like more than I liked es... It does a 14 day trial before you have to buy in, But there are a bunch of alternatives that aren't pay to use, such as Amaze File manager which is open source, so it should never be pay to use.

In my phone the reason for the lockscreen was the Xender File Sharing App. When I clicked the little gear(settings) icon on the top right corner it gave me an option to switch off the Xender Quikcharge feature and so I did. I don't get this screen anymore.
I went to the Xender app page on the Google Play Store and a lot of other users had also complained about the same problem. Hope this helps.

Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).